Community resources

The Global Intelligence Files

On Monday February 27th, 2012, WikiLeaks began publishing The Global Intelligence Files, over five million e-mails from the Texas headquartered "global intelligence" company Stratfor. The e-mails date between July 2004 and late December 2011. They reveal the inner workings of a company that fronts as an intelligence publisher, but provides confidential intelligence services to large corporations, such as Bhopal's Dow Chemical Co., Lockheed Martin, Northrop Grumman, Raytheon and government agencies, including the US Department of Homeland Security, the US Marines and the US Defence Intelligence Agency. The emails show Stratfor's web of informers, pay-off structure, payment laundering techniques and psychological methods.

Given the analysis of Stuxnet already by Symantec, et al, it won't.
Unless it's targetting a specific Chinese facility. Though what the
Chinese should be rightly freaked about is the possibility of it
collecting intelligence on a lot of their systems.

I also haven't read into this biblical stuff yet. Saw it late last night
and fell asleep.
Nick Miller wrote:

How badly do you think this worm will disrupt China's energy
infrastructure and military facilities?

nick

Chris Farnham wrote:

Last line of this piece says that it doesn't communicate back (maybe
it's more so that it doesn't communicate results, not that it doesn't
com)...., not that I'm vouching for the validity of this claim, just
that it is there.
My local Chinese quack says that stuxnet can be cured by garlic, dried
snake penis and a cup of warm water....

In a Computer Worm, a Possible Biblical Clue

By JOHN MARKOFF and DAVID E. SANGER

Published: September 29, 2010

Deep inside the computer worm that some specialists suspect is aimed
at slowing Iran's race for a nuclear weapon lies what could be a
fleeting reference to the Book of Esther, the Old Testament tale in
which the Jews pre-empt a Persian plot to destroy them

That use of the word "Myrtus" - which can be read as an allusion to
Esther - to name a file inside the code is one of several murky clues
that have emerged as computer experts try to trace the origin and
purpose of the rogue Stuxnet program, which seeks out a specific kind
of command module for industrial equipment.

Not surprisingly, the Israelis are not saying whether Stuxnet has any
connection to the secretive cyberwar unit it has built inside Israel's
intelligence service. Nor is the Obama administration, which while
talking about cyberdefenses has also rapidly ramped up a broad covert
program, inherited from the Bush administration, to undermine Iran's
nuclear program. In interviews in several countries, experts in both
cyberwar and nuclear enrichment technology say the Stuxnet mystery may
never be solved.

There are many competing explanations for myrtus, which could simply
signify myrtle, a plant important to many cultures in the region. But
some security experts see the reference as a signature allusion to
Esther, a clear warning in a mounting technological and psychological
battle as Israel and its allies try to breach Tehran's most heavily
guarded project. Others doubt the Israelis were involved and say the
word could have been inserted as deliberate misinformation, to
implicate Israel.

"The Iranians are already paranoid about the fact that some of their
scientists have defected and several of their secret nuclear sites
have been revealed," one former intelligence official who still works
on Iran issues said recently. "Whatever the origin and purpose of
Stuxnet, it ramps up the psychological pressure."

So a calling card in the code could be part of a mind game, or
sloppiness or whimsy from the coders.

The malicious code has appeared in many countries, notably China,
India, Indonesia and Iran. But there are tantalizing hints that Iran's
nuclear program was the primary target. Officials in both the United
States and Israel have made no secret of the fact that undermining the
computer systems that control Iran's huge enrichment plant at Natanz
is a high priority. (The Iranians know it, too: They have never let
international inspectors into the control room of the plant, the
inspectors report, presumably to keep secret what kind of equipment
they are using.)

The fact that Stuxnet appears designed to attack a certain type of
Siemens industrial control computer, used widely to manage oil
pipelines, electrical power grids and many kinds of nuclear plants,
may be telling. Just last year officials in Dubai seized a large
shipment of those controllers - known as the Simatic S-7 - after
Western intelligence agencies warned that the shipment was bound for
Iran and would likely be used in its nuclear program.

"What we were told by many sources," said Olli Heinonen, who retired
last month as the head of inspections at the International Atomic
Energy Agency in Vienna, "was that the Iranian nuclear program was
acquiring this kind of equipment."

Also, starting in the summer of 2009, the Iranians began having
tremendous difficulty running their centrifuges, the tall, silvery
machines that spin at supersonic speed to enrich uranium - and which
can explode spectacularly if they become unstable. In New York last
week, Iran's president, Mahmoud Ahmadinejad, shrugged off suggestions
that the country was having trouble keeping its enrichment plants
going.

Yet something - perhaps the worm or some other form of sabotage, bad
parts or a dearth of skilled technicians - is indeed slowing Iran's
advance.

The reports on Iran show a fairly steady drop in the number of
centrifuges used to enrich uranium at the main Natanz plant. After
reaching a peak of 4,920 machines in May 2009, the numbers declined to
3,772 centrifuges this past August, the most recent reporting period.
That is a decline of 23 percent. (At the same time, production of
low-enriched uranium has remained fairly constant, indicating the
Iranians have learned how to make better use of fewer working
machines.)

Computer experts say the first versions of the worm appeared as early
as 2009 and that the sophisticated version contained an internal time
stamp from January of this year.

These events add up to a mass of suspicions, not proof. Moreover, the
difficulty experts have had in figuring out the origin of Stuxnet
points to both the appeal and the danger of computer attacks in a new
age of cyberwar.

For intelligence agencies they are an almost irresistible weapon, free
of fingerprints. Israel has poured huge resources into Unit 8200, its
secretive cyberwar operation, and the United States has built its
capacity inside the National Security Agency and inside the military,
which just opened a Cyber Command.

But the near impossibility of figuring out where they came from makes
deterrence a huge problem - and explains why many have warned against
the use of cyberweapons. No country, President Obama was warned even
before he took office, is more vulnerable to cyberattack than the
United States.

For now, it is hard to determine if the worm has infected centrifuge
controllers at Natanz. While the S-7 industrial controller is used
widely in Iran, and many other countries, even Siemens says it does
not know where it is being used. Alexander Machowetz, a spokesman in
Germany for Siemens, said the company did no business with Iran's
nuclear program. "It could be that there is equipment," he said in a
telephone interview. "But we never delivered it to Natanz."

But Siemens industrial controllers are unregulated commodities that
are sold and resold all over the world - the controllers intercepted
in Dubai traveled through China, according to officials familiar with
the seizure.

Ralph Langner, a German computer security consultant who was the first
independent expert to assert that the malware had been "weaponized"
and designed to attack the Iranian centrifuge array, argues that the
Stuxnet worm could have been brought into the Iranian nuclear complex
by Russian contractors.

"It would be an absolute no-brainer to leave an infected USB stick
near one of these guys," he said, "and there would be more than a 50
percent chance of having him pick it up and infect his computer."

There are many reasons to suspect Israel's involvement in Stuxnet.
Intelligence is the single largest section of its military and the
unit devoted to signal, electronic and computer network intelligence,
known as Unit 8200, is the largest group within intelligence.

Yossi Melman, who covers intelligence for the newspaper Haaretz and is
at work on a book about Israeli intelligence over the past decade,
said in a telephone interview that he suspected that Israel was
involved.

He noted that Meir Dagan, head of Mossad, had his term extended last
year partly because he was said to be involved in important projects.
He added that in the past year Israeli estimates of when Iran will
have a nuclear weapon had been extended to 2014.

"They seem to know something, that they have more time than originally
thought," he said.

Then there is the allusion to myrtus - which may be telling, or may be
a red herring.

Several of the teams of computer security researchers who have been
dissecting the software found a text string that suggests that the
attackers named their project Myrtus. The guava fruit is part of the
Myrtus family, and one of the code modules is identified as Guava.

It was Mr. Langner who first noted that Myrtus is an allusion to the
Hebrew word for Esther. The Book of Esther tells the story of a
Persian plot against the Jews, who attacked their enemies
pre-emptively.

"If you read the Bible you can make a guess," said Mr. Langner, in a
telephone interview from Germany on Wednesday.

Carol Newsom, an Old Testament scholar at Emory University, confirmed
the linguistic connection between the plant family and the Old
Testament figure, noting that Queen Esther's original name in Hebrew
was Hadassah, which is similar to the Hebrew word for myrtle. Perhaps,
she said, "someone was making a learned cross-linguistic wordplay."

But other Israeli experts said they doubted Israel's involvement. Shai
Blitzblau, the technical director and head of the computer warfare
laboratory at Maglan, an Israeli company specializing in information
security, said he was "convinced that Israel had nothing to do with
Stuxnet."

"We did a complete simulation of it and we sliced the code to its
deepest level," he said. "We have studied its protocols and
functionality. Our two main suspects for this are high-level
industrial espionage against Siemens and a kind of academic
experiment."

Mr. Blitzblau noted that the worm hit India, Indonesia and Russia
before it hit Iran, though the worm has been found disproportionately
in Iranian computers. He also noted that the Stuxnet worm has no code
that reports back the results of the infection it creates. Presumably,
a good intelligence agency would like to trace its work.

I love how much the Chinese are talking about this. The fact that it
can communicate with a command and control server was known before--it
sends, at minimum, information of the configuration of whatever
industrial plant it has infected. Though I do believe it needs an
internet connection for that one (or maybe could update itself and
reinfect a USB key for the information to be passed on later). It has
not been said that it allows a backdoor to take over any industrial
facility. In fact, it seems pretty clear it can't do that, but I
could be wrong.

The other interesting thing here is that it says 'the source of the
attack was computer servers based in the US.' That has not been said
so directly before, so I'm curious if they mean that they think the US
is responsible, or if they have evidence of it communicating with
servers there. The other diagnostics on Stuxnet found it
communicating with a server in Malaysia.

Antonia Colibasanu wrote:

Some info in here that contradicts other info I've seen, namely
that it transmits info back to a source [chris]

[IMG]
http://www.scmp.com/portal/site/SCMP/menuitem.2af62ecb329d3d7733492d9253a0a0a0/?vgnextoid=2680c09bf3e5b210VgnVCM100000360a0a0aRCRD&ss=China&s=News
A highly sophisticated computer virus that security experts described as the world's "first cyber super-weapon" has hit China, affecting almost
all the key industrial sectors on the mainland.

The cyber worm, known as Stuxnet, seeks and attacks control systems created by German multinational Siemens - one of China's biggest overseas
suppliers of industrial computers. It has infected 6 million computers and "nearly a thousand" industrial plants and facilities in China over the
past few days, Xinhua reported yesterday. The source of the attack was computer servers based in the US, Xinhua said.

A Siemens spokeswoman said the system was also used by companies in Hong Kong, but so far it had not received any reports of an attack in the
city. Siemens' clients include Hong Kong International Airport, Disneyland, railways, CLP Power and St Paul's Hospital in Causeway Bay. The MTR
and CLP said they had been contacted by Siemens and were told their systems were not affected.

Mainland experts said the potential threat of the virus to China's national security was "unprecedented", as the spyware not only steals and
transmits sensitive data of the infected hosts to the hacker but also leaves a back door open for remote control and manipulation.

"Alarm bells have been sounded in almost every key industrial sector - steel, energy, transport ... This has never happened before," said Wang
Zhantao , a network security engineer with antivirus service provider Beijing Rising International Software.

Beijing said it would closely monitor the situation and may order a nationwide assessment of Siemens systems. "If it is serious, we may re-examine
the issuing of licences for Siemens products," an official from the Ministry of Industry and Information Technology said.

Siemens' headquarters in Munich refused to comment on the impact of the virus on its Chinese clients but said it was working to fix the problem.
Neither Beijing nor Siemens would provide a full list of the industrial facilities affected by the virus. Siemens' system is widely used by
airports, railways, including the Shanghai maglev, nuclear power plants and the Three Gorges Dam.

Professor Sun Jianping , a hydropower expert, said he was worried. Sun led a study on the reliability and stability of the generators at the Three
Gorges Dam, which are controlled and monitored by a Siemens system vulnerable to the virus. "If someone hacks into the system and takes over, we
will be blinded and disabled," he said. "It could cause more destruction than a bomb."

The Stuxnet virus attacking China is the same type found at Iran's first nuclear plant, Bushehr, this month. The plant suffered only slight damage
from the internet-based attacks but the virus alarmed security experts worldwide. The plant will begin supplying energy early next year after a
delay of several months.

Stuxnet is a highly complex malware - malicious software - that has never been seen before. It is so advanced that experts believed that a state
may have been involved in creating it. Unlike ordinary spyware that attack personal computers, Stuxnet targeted Siemens control systems. It uses
personal computers as springboards to search and attack main computer systems installed with the Siemens programme.

It can be transferred by USB memory stick, or other flash memory such as digital cameras. A worker with an infected USB stick could unknowingly
plug it into a company network, bypassing the firewall, transferring the virus to the system.

The virus uses four previously unknown security holes in Microsoft Windows to seek the database for Siemens' supervisory control and data
acquisition software (SCADA), which is widely used to run factories, chemical, water supply and power plants around the world.

"An employee who plugs his MP3 player into a company computer can wreck the whole production plant without knowing it," Wang said.

A senior sales manager with Rockwell Automation, a direct competitor of Siemens', said the fact the company's codec was based on Microsoft Windows
has turned out to be a fatal weakness. "The exploitable codec buries deep into the core of nearly all Siemens' high-end industrial products -
sometimes in the form of [computer] chips. So the hole is not peripheral, but central," he said.

A spokesman for Langner Communication, a German security research firm that analysed the Stuxnet malware, said it was "a direct attack against
sensitive industrial control systems". "With the forensics we now have, it is clear that this is a direct sabotage attack involving heavy insider
knowledge," he said.

According to Siemens company records, it first detected the virus on July 15 based on information from a customer. The subsequent investigation
revealed that trojan-spy software had worked its way into the system used to operate factory and utility facilities automatically.

Within a couple of days Siemens managed to isolate and analyse the newly detected cyber worm. "This is a really complex virus," said company
spokesman Alexander Machowetz.

A Siemens spokeswoman in Hong Kong yesterday said the company had provided its customers with "a tool for downloading [anti-virus software] which
detects and removes the virus without interrupting plant operation" since July 22. She said Microsoft had also closed the security breach in the
operating system and the virus would not be able to infiltrate industrial plant computers if systems were updated. Siemens directed concerned
customers to support.automation.siemens.com/WW/view/en/43876783 for further information.

Before Stuxnet, industrial companies have rarely, if ever, been exposed to cyber attacks - common to personal computers - because their operating
systems are different and their networks behind robust firewalls. But Stuxnet can infect both types of computer, as it can infiltrate firewalls
through personal computers and USB discs.

Security experts worry that the sophisticated nature of the virus could fuel a worldwide "cyber arms race".

"The Stuxnet worm is a wake-up call to governments around the world," said Derek Reveron, professor of national security and a cyber expert at the
US Naval War School in Rhode Island. "It is the first known worm to target industrial control systems and grants hackers vital control of vital
public infrastructures like power plants, dams and chemical facilities."